Dell PowerSwitch S5212F-ON EMC SmartFabric OS10 User Guide Release 10.5.0 - Page 1031

Default Not configured Command mode EXEC Usage information When you delete the system's certificate, you also delete the private key. Do not delete a host certificate that is used in a security profile. To display the currently installed host certificate and associated key, use the show crypto cert command. NOTE: A FIPS-compliant and non-FIPS certificate may have the same file name. To delete a FIPS- compliant certificate, you must enter the fips parameter in the command. Example OS10# crypto cert delete Dell_host1_CA1.pem Certificate and keys were successfully deleted. CN = Dell_host1_CA1 Supported releases 10.4.3.0 or later crypto cert generate Creates a certificate signing request (CSR) or a self-signed certificate. Syntax Parameters crypto cert generate {request | self-signed} [cert-file cert-path key-file {private | keypath}] [country 2-letter code] [state state] [locality city] [organization organization-name] [orgunit unit-name] [cname common-name] [email email-address] [validity days] [length length] [altname alt-name] • request - Create a certificate signing request to copy to a CA. • self-signed - Create a self-signed certificate. • cert-file cert-path - (Optional) Enter the local path where the self-signed certificate or CSR is stored. You can enter a full path or a relative path; for example, flash://certs/s4810-001request.csr or usb://s4810-001.crt. If you do not enter the cert-file option, the system interactively prompts you to fill in the remaining fields of the certificate signing request. Export the CSR to a CA using the copy command. • key-file {key-path | private} - Enter the local path where the downloaded or locally generated private key is stored. If the key was downloaded to a remote server, enter the server path using a secure method, such as HTTPS, SCP, or SFTP. Enter private to store the key in a local hidden location. • country 2-letter-code - (OPTIONAL) Enter the two-letter code that identifies the country. • state state - Enter the name of the state. • locality city - Enter the name of the city. • organization organization-name - Enter the name of the organization. • orgunit unit-name - Enter name of the unit. • cname common-name - Enter the common name assigned to the certificate. Common name is the main identity presented to connecting devices. By default, the switch's host name is the common name. You can configure a different common name for the switch; for example, an IP address. If the common-name value does not match the device's presented identity, a signed certificate does not validate. • email email-address - Enter a valid email address used to communicate with the organization. • validity days - Enter the number of days that the certificate is valid. For a CSR, validity has no effect. For a self-signed certificate, the default is 3650 days or 10 years. • length bit-length - Enter a bit value for the keyword length. For FIPS mode, the range is from 2048 to 4096; for non-FIPS mode, the range is from 1024 to 4096. The default key length for both FIPS and nonFIPS mode is 2048 bits. The minimum key length value for FIPS mode is 2048 bits. The minimum key length value for non-FIPS mode is 1024 bits. • altname altname - Enter an alternate name for the organization; for example, using the IP address such as altname IP:192.168.1.100. Default Not configured Command mode EXEC Usage information Generate a CSR when you want a CA to sign a host certificate. Generate a self-signed certificate if you do not set up a CA and implement a certificate trust model in your network. Security 1031